Zyxel GS1900 Zero-Day CVE-2026-107441 Bypasses June Patch, Exploited by JITTERLY Backdoor Operators
Binarly researchers Fernando Mercês and Yegor Vasilenko discovered CVE-2026-107441, an unauthenticated out-of-bounds write vulnerability in the Zyxel GS1900 web interface's dispatcher.cgi, after analyzing an exploit found on a command-and-control server used by the JITTERLY Linux backdoor (which drops the SIXZUT rootkit). The flaw was previously masked by misattribution: a September attack wave that compromised 996 GS1900 switches in 48 countries was linked by GreyNoise and CISA KEV to CVE-2026-7273, which Zyxel patched in June. However, Binarly found the real-world exploit still works unmodified against the patched firmware, proving the attackers were actually exploiting a distinct, previously unknown flaw now tracked as CVE-2026-107441 with a CVSS score of 8.8. Zyxel released corrected firmware on October 22, and administrators who believed they were protected after the June patch must update again immediately.
Entenda a falha
A vulnerabilidade
CVE-2026-107441 is an out-of-bounds write in dispatcher.cgi, the web interface component of Zyxel GS1900 switches. An unauthenticated attacker on the adjacent network can send a crafted HTTP POST and run OS commands. It has a CVSS 3.1 score of 8.8 and is exploited in the wild. Firmware 2.90(xxxx.2)C0 and earlier is affected on the GS1900-8, 8HP, 10HP, 16, 24, 24E, 24EP, 24HPv2, 48 and 48HPv2. The firmware Zyxel released on October 22 fixes it. CVE-2026-7273, patched in June, is a related flaw that was exploited earlier and does not stop this one.
Como funciona
The switch's web server passes HTTP POST requests to dispatcher.cgi. The program copies each request parameter into a fixed global buffer. It does not check how large each parameter is or how many parameters arrive. A crafted request therefore corrupts memory and allows writes across a wide range of the process address space. Binarly says the exploit uses that write to redirect program execution and run commands. The June fix added checks too late, after the parameter counter had already been corrupted.
Por que é vulnerável
The root cause is a missing bounds check: parameter size and parameter count are not validated before data is copied into a fixed global buffer. The June patch for CVE-2026-7273 put its checks too late in the flow, so the counter could still be corrupted first. Zyxel told Binarly that CVE-2026-7273 covered a missing counter check, although its advisory described a stack overflow, and it treats the missing size check as a separate flaw. That mismatch helps explain why the flaw stayed hidden behind the earlier CVE. Binarly confirms the new firmware limits each copied field to 511 bytes and checks the parameter count before copying.
Onde está
The flaw is in dispatcher.cgi, the CGI program of the GS1900 web interface that handles HTTP POST requests.
Como foi descoberta
Binarly researchers Fernando Mercês and Yegor Vasilenko found it while tracking JITTERLY, a Linux backdoor that drops the SIXZUT rootkit, which Acronis TRU had linked to Gitea attacks. The backdoor's command server had an open directory holding an obfuscated Python exploit labeled "Zyxel GS1900 Pre-Auth RCE". Its configuration listed addresses for the patched GS1900-24 firmware, and it worked unchanged against that firmware. In September GreyNoise reported 996 switches compromised in 48 countries and tied the attacks to CVE-2026-7273, which CISA added to KEV on September 21. Binarly's findings show the attackers were using a different, unknown flaw. Zyxel released fixed firmware on October 22.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
A working exploit exists: an obfuscated Python script found on the JITTERLY command server, which Binarly believes is LLM-generated. The researchers validated it on real hardware, where it gives unauthenticated remote code execution on switches running the June-patched firmware. It has been used in real attacks, so it is weaponized. Binarly plans to release a minimized proof of concept later, but no public copy exists yet. Patch urgently, and treat switches exposed before patching as possibly compromised.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 09:10.
Detalhes técnicos
The vulnerability resides in dispatcher.cgi, which handles HTTP POST requests and copies each parameter into a fixed global buffer without checking parameter size or count, allowing memory corruption and arbitrary write across a wide address range to hijack program execution and run OS commands on the adjacent network without authentication. The earlier CVE-2026-7273 fix added checks too late in the process, after the parameter counter was already corrupted, leaving the window open. Binarly assesses the exploit found in the JITTERLY C2 open directory, labeled "Zyxel GS1900 Pre-Auth RCE," was likely LLM-generated, and the researchers validated it against real hardware. Affected firmware is version 2.90(xxxx.2)C0 and earlier across the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2 models.
Remediação
Install the firmware Zyxel released on October 22 immediately, as the prior June patch for CVE-2026-7273 does not stop this exploit. Keep the switch web interface off untrusted networks and restrict it to a management VLAN. Change factory default credentials, since GreyNoise found 564 victims still using them. Treat any switch exposed before patching as potentially compromised.
Linha do tempo
-
Zyxel GS1900 Zero-Day CVE-2026-107441 Bypasses June Patch, Exploited by JITTERLY Backdoor Operators
ler a análise desta fonte ocultar
Binarly researchers Fernando Mercês and Yegor Vasilenko discovered CVE-2026-107441, an unauthenticated out-of-bounds write vulnerability in the Zyxel GS1900 web interface's
dispatcher.cgi, after analyzing an exploit found on a command-and-control server used by the JITTERLY Linux backdoor (which drops the SIXZUT rootkit). The flaw was previously masked by misattribution: a September attack wave that compromised 996 GS1900 switches in 48 countries was linked by GreyNoise and CISA KEV to CVE-2026-7273, which Zyxel patched in June. However, Binarly found the real-world exploit still works unmodified against the patched firmware, proving the attackers were actually exploiting a distinct, previously unknown flaw now tracked as CVE-2026-107441 with a CVSS score of 8.8. Zyxel released corrected firmware on October 22, and administrators who believed they were protected after the June patch must update again immediately.Technical Details
The vulnerability resides in
dispatcher.cgi, which handles HTTP POST requests and copies each parameter into a fixed global buffer without checking parameter size or count, allowing memory corruption and arbitrary write across a wide address range to hijack program execution and run OS commands on the adjacent network without authentication. The earlier CVE-2026-7273 fix added checks too late in the process, after the parameter counter was already corrupted, leaving the window open. Binarly assesses the exploit found in the JITTERLY C2 open directory, labeled "Zyxel GS1900 Pre-Auth RCE," was likely LLM-generated, and the researchers validated it against real hardware. Affected firmware is version 2.90(xxxx.2)C0 and earlier across the GS1900-8, GS1900-8HP, GS1900-10HP, GS1900-16, GS1900-24, GS1900-24E, GS1900-24EP, GS1900-24HPv2, GS1900-48 and GS1900-48HPv2 models.Remediation
Install the firmware Zyxel released on October 22 immediately, as the prior June patch for CVE-2026-7273 does not stop this exploit. Keep the switch web interface off untrusted networks and restrict it to a management VLAN. Change factory default credentials, since GreyNoise found 564 victims still using them. Treat any switch exposed before patching as potentially compromised.